Infostealers Defined in Plain Terms
An infostealer is a type of malware that quietly collects sensitive data from an infected device including saved browser passwords, session cookies, autofill details, payment-card data and cryptocurrency wallets, then sends it to an attacker. The stolen data known as a log, is sold on criminal marketplaces or used to break into accounts.
Most infostealers are rented, not written. They are sold as a service by subscription which puts industrial-grade credential theft within reach of low-skilled criminals. One infection on a single laptop including an employee’s own device, can hand over the keys to email, cloud consoles and online banking.
The damage rarely stops at the first victim. In Verizon’s 2025 Data Breach Investigations Report, 54 percent of ransomware victims had their organisation’s domain appear in infostealer logs before the attack. Stolen credentials are the quiet first step in many larger breaches.
The timing matters in Sweden. Cybersäkerhetslagen (SFS 2025:1506) brought NIS2 into Swedish law on 15 January 2026, and the ransomware wave it responds to runs on stolen access. The Miljödata supplier attack in August 2025 disrupted services across roughly 200 of Sweden’s 290 municipalities, a reminder of how far one compromise can travel.
How Infostealers Work
An infostealer attack has three stages and none of them needs the victim to notice. The malware is delivered, it harvests data and it sends the data out, usually in seconds.
Delivery is usually social. Spearphishing links and attachments are the leading route according to a May 2025 advisory from the FBI and CISA on the LummaC2 stealer. Attackers also use malvertising, fake software updates, cracked or pirated applications and fake verification pages that trick a user into running a command.
Harvesting happens fast. Once it runs, the malware reads saved logins and cookies from browsers, copies autofill and payment-card data, grabs cryptocurrency wallets and collects FTP, SSH and VPN credentials. Many stealers then delete themselves to leave little trace behind.
Exfiltration is built to hide. Vidar, for example, reads its current control-server address from a profile on a legitimate platform such as Telegram, Mastodon or Steam, a dead drop resolver technique documented in a US Department of Health and Human Services analyst note. Because the lookup touches a trusted site, it is hard to block.
The stolen data then enters an economy. Logs are bundled and sold on criminal marketplaces, sometimes for less than a euro each, where initial access brokers and ransomware crews buy them. This resale is what turns one infection into many separate attacks.
What changed is the business model. Malware-as-a-service means a subscriber rents the stealer, a control panel and support, so the skill barrier is low and the volume is high.
Common Infostealer Families
Infostealers are a crowded market. A few families account for most of the activity and a few names appear repeatedly in detections and takedowns. They differ in the detail and share one goal, which is to harvest credentials and sell the result.
RedLine Stealer
RedLine was among the most widespread infostealers before law enforcement disrupted it in October 2024. Sold as a service, it steals browser logins, cookies, card data and cryptocurrency wallets along with FTP and VPN credentials. Eurojust described RedLine and its clone Meta as among the largest malware platforms in the world with millions of victims.
Vidar
Vidar first appeared in 2018 and is widely tracked as an evolution of the earlier Arkei trojan. It harvests browser data, cookies, card details, crypto wallets and authenticator tokens, then packs the loot into an archive to send out. Its signature trick, documented in a US Department of Health and Human Services analyst note, is hiding its control server behind profiles on legitimate platforms such as Telegram and Mastodon and researchers have seen Steam profiles abused the same way.
LummaC2, or Lumma Stealer
LummaC2, also called Lumma Stealer, emerged in 2022 on Russian-speaking forums and grew into one of the most widely used stealers in the criminal market. The FBI has identified at least 1.7 million instances where it was used to steal information. A May 2025 takedown led by the US Department of Justice disrupted its infrastructure, yet researchers observed activity resuming within weeks.
Meta Stealer
Meta or MetaStealer, surfaced in 2022 as a near-identical clone of RedLine, very likely from the same developers, and was taken down alongside it in the same operation.
Infostealer, Trojan or Spyware?
These labels overlap. An infostealer is a form of spyware, meaning software that covertly collects data. It usually arrives as a trojan, disguised as or bundled with something that looks legitimate. So an infostealer trojan and a spyware infostealer describe the same threat from different angles.
The Business Impact of Infostealers
An infostealer does not encrypt your files or announce itself. Its value to an attacker is access and access is what makes it expensive.
The first cost is account takeover. Stolen passwords let criminals into email, payroll, cloud consoles and bank accounts, where they commit fraud or move deeper into the network.
The second cost is lost trust in your defences. Infostealers grab session cookies, the tokens that keep you logged in after you sign on. With a stolen cookie an attacker can resume your session without the password and, in many cases, without facing multi-factor authentication because the check was already passed when the cookie was issued.
The third cost is ransomware. Credential theft is a common first step. In Verizon’s 2025 report, 54 percent of ransomware victims had prior exposure in infostealer logs, and 40 percent of those records held a corporate email address. Access brokers sell the way in and ransomware crews walk through it.
The fourth cost is mass data theft. In 2024 attackers used credentials harvested by infostealers, some of them years old, to log into cloud data-warehouse accounts and steal records at scale. CISA issued an alert in June 2024 and at least 165 organisations were notified as potentially exposed.
On top of these sits the regulatory bill. A stolen credential that leads to a personal-data breach starts the clock on reporting duties under NIS2 and GDPR with fines and board-level accountability attached.
Real-World Infostealer Cases
Each case below is a named, documented event with the one control that would have limited the damage.
The RedLine and Meta Takedown (Operation Magnus)
On 28 October 2024 the Dutch National Police and the FBI, coordinated by Eurojust and joined by Belgium, Portugal, the UK and Australia, disrupted the RedLine and Meta infostealers. Investigators took down three servers in the Netherlands, seized two domains and gained access to the operators’ back-end data.
Two people were detained in Belgium and US prosecutors unsealed charges against Maxim Rudometov, named as an alleged RedLine developer and administrator. According to Eurojust, the recovered data included usernames, passwords, email addresses, bank account details and payment-card numbers from millions of victims.
The hard truth is that the logs outlived the servers. Credentials stolen before the takedown are still traded so the practical response is to assume any password that ever lived in a browser may be exposed and to reset it.
The Genesis Market Shutdown (Operation Cookie Monster)
On 4 April 2023 the FBI and the Dutch National Police, supported by Europol and Eurojust, shut down Genesis Market, with around 120 arrests and more than 200 searches. Running since 2018, Genesis had offered access to data from over 1.5 million compromised computers and more than 80 million account credentials.
Genesis went beyond passwords. It sold bots that bundled stolen credentials, cookies and device fingerprints, so a buyer could impersonate the victim and walk past login checks. Prices started from about 0.70 US dollars.
Genesis shows why cookie theft matters as much as stolen passwords. To limit it, keep browser sessions short, re-authenticate for sensitive actions, revoke sessions when risk signals appear and keep corporate logins out of personal browsers.
The 2024 Snowflake Customer Breaches
In 2024 a financially motivated group logged into cloud data-warehouse accounts belonging to customers of the platform Snowflake. They used valid credentials harvested by infostealers, some dating back to 2020, that had never been rotated. There was no flaw in the platform itself.
The accounts were not protected by multi-factor authentication. CISA issued an alert on 3 June 2024, at least 165 organisations were notified as potentially exposed and large firms including AT&T and Ticketmaster were among the reported victims. Snowflake later began enforcing MFA by default for new accounts.
The lesson is blunt. Enforce phishing-resistant MFA on every account including SaaS and cloud consoles, and rotate credentials on a schedule so a stolen password expires before it is used.
Infostealers and Compliance
For Swedish organisations, a credential theft is not only an IT problem. It can trigger legal duties with firm deadlines.
Cybersäkerhetslagen (SFS 2025:1506) brought NIS2 into Swedish law on 15 January 2026. Article 21 of NIS2 requires risk-management measures that bear directly on infostealers, including multi-factor authentication and access control, incident handling and reporting (21.2b), supply-chain security (21.2d) and security awareness training (21.2g). Under Article 20 the board is responsible and can be held personally accountable. See our guidance on NIS2 compliance for the full picture.
If an infostealer leads to a significant incident, the reporting cascade to MCF (formerly MSB) and the sector authority runs on a 24-hour early warning, a 72-hour full notification and a final report within one month.
Where stolen credentials expose personal data, GDPR compliance adds a separate duty under Article 33, a 72-hour notification to IMY, the Swedish data protection authority. Financial entities carry more still, as DORA compliance under Article 17 governs ICT incident management and is supervised by Finansinspektionen.
These duties overlap, so plan them together. A certified management system under ISO 27001 gives you the access control, monitoring and incident process that each of them expects.
How to Spot an Infostealer
Infostealers are built to be invisible, so spotting one is less about watching the laptop and more about watching the accounts. A few signs are worth acting on.
- A credential-monitoring or dark-web alert that your email or password has appeared in a leak or stealer log.
- Logins from unexpected places or at odd hours, or two active sessions for one account at once.
- Security prompts you did not trigger, such as password-reset or MFA requests.
- A new browser extension, scheduled task or program that nobody installed.
- Antivirus or EDR flagging a suspicious process, even briefly.
Here is the honest part. Many infostealers run in seconds and then delete themselves so the infected device may show nothing at all. That is why credential-exposure monitoring and behavioural detection on endpoints matter more than waiting for an obvious symptom.
How to Defend Against Infostealers
You cannot stop every infection but you can make a stolen credential almost worthless. Work through people, process and technology and start with the controls that take the most value away from an attacker.
- Enforce phishing-resistant multi-factor authentication on every account including SaaS and cloud consoles. Do not leave any admin or tenant login on a password alone.
- Shorten session lifetimes and re-authenticate for sensitive actions so a stolen cookie expires quickly. Revoke active sessions when risk signals appear.
- Stop storing corporate passwords in browsers. Give staff a managed password manager and turn off browser credential saving where you can.
- Monitor for exposed credentials and rotate them fast. Treat any credential found in a leak or stealer log as already compromised.
- Harden endpoints. Run EDR with behavioural detection, restrict admin rights, use application control and block software from untrusted or user-writable locations.
- Cut off the delivery routes. Filter malicious ads and sites, and block cracked or pirated software, which is a common infostealer carrier.
- Patch promptly to shrink the attack surface that drive-by and malvertising infections rely on.
- Govern unmanaged and contractor devices. A personal laptop with saved corporate logins is a supply-chain risk, as the Snowflake case showed.
- Train people to recognise fake installers, cracked software and fake verification pages, which NIS2 treats as a required control.
- Keep an incident response plan ready so you can meet the NIS2 reporting deadlines if a theft becomes a breach.
